How to Handle Access and Correction Requests
- Name an owner, ticket template, and evidence habit before you debate edge-case wording.
- Start from the smallest repeatable path; avoid boiling the ocean.
- Log decisions so rights and complaints do not reopen old debates.
- Pair this with data mapping and retention reality—not policy alone.
- Escalate interpretation questions; do not invent legal certainty here.
See also: Compliance portal · Official resources · Guides index
If your team receives rights-related requests, the real challenge is process discipline, not just legal awareness.
What the Act actually requires
Section 11 gives a Data Principal the right to a summary of the personal data you process about her and the identities of any other Data Fiduciaries or Data Processors you shared it with. Section 12 covers correction, completion, updating, and erasure: on a correction request you must fix inaccurate or misleading data, complete incomplete data, and update it; on an erasure request under Section 12(3), you must erase the data unless retention is still necessary for the specified purpose or required by law. Neither section sets a fixed response-day SLA in the Act itself — the prescribed manner for making these requests is left to the rules, so check your published process matches what you actually do.
What good handling requires
- Clear ownership
- System awareness
- Response logging
- Escalation path for edge cases